CVE-2015-1042

Loading...

General

Score:5.8/10.0
Severity:Medium
Category:N/A

Impact Metrics

Confidentiality:Partial
Integrity:Partial
Availability:None

Exploitability Metrics

Access Vector:Network
Access Complexity:Medium
Authentication:None

Relative vulnerabilities

CVE-2014-6316, CVE-2014-9571, CVE-2014-9572, CVE-2014-9573, CVE-2014-9624

Published on 10/02/15 - Updated on 27/11/15

Description

The string_sanitize_url function in core/string_api.php in MantisBT 1.2.0a3 through 1.2.18 uses an incorrect regular expression, which allows remote attackers to conduct open redirect and phishing attacks via a URL with a ":/" (colon slash) separator in the return parameter to login_page.php, a different vulnerability than CVE-2014-6316.

Category:

There is insufficient information about the issue to classify it; details are unknown or unspecified.

Security Notices

US National Vulnerability DatabaseCVE-2015-1042
Arch Linux ASA-201502-3

Exploits

No exploits available for this CVE in our database.

Relative technologies

VendorProduct
mantisbtmantisbt

Share this vulnerability with:

Twitter Facebook LinkedIn Mail